All Detections

Suspicious Schtasks Execution AppData Folder

avatar
SigmaHQ Detections@sigmaHQ
updated Oct 23, 2025000

Detects the creation of a schtask that executes a file from C:\Users\<USER>\AppData\Local

Sigma